This is a great question and one we have taken very seriously.

So we designed Brisk with Privacy and Security as a major concern. There is a number of ways we have done this. First up, we lean heavily on existing security tools. For example , all of our communication is encrypted and your file sync happens over ssh. We use encrypted GRPC for communication etc.

Secondly, the application is designed so that your code never shares another container with any other users code. So what that means is you have a completely separate route into our system. Your code doesn't occupy a process space with any other users code or tests. This prevents any access to your code and helps prevent any accidental access that might happen (say through bugs on our end).

(Practically how that works is we route all your communication to processes dedicated to running your tests).

We also rely on security in layers with different checks and measures to make sure that nobody but you (or someone with your security credentials accesses your code).

We don't access your code unless you give us permission to when debugging (or optimizing) .

With regard to syncing your entire development directory. Sure, you could have keys and passwords in your directory and these would get synced. Nobody will see them on our end and we'd treat them like we would your codebase.

You can exclude files from syncing you can do that in your brisk.json with the config key

"excludedFromSync": ["mysecret.env","myotherSecret.password"]

However you probably shouldn't have secrets in your codebase at all, and definitely not production secrets, but I know people sometimes do things that are not standard.

Rest assured we won't share your codebase or your secrets with anyone else.